Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
5.9
Firefox ESR can forward local traffic to external server
published 4 days ago
Summary
When Firefox ESR’s automatic proxy setting is turned on, a specially crafted proxy configuration file can tell the browser to send requests that should stay on the computer (to localhost) to a remote proxy instead. This could expose internal data or allow an attacker to intercept traffic. Disable automatic proxy detection or apply the latest Firefox ESR update to stop this behavior.
What to do
- Update cleanstart firefox-esr to version 60.6.1-r0.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| CleanStart | cleanstart | firefox-esr |
< 60.6.1-r0 Fix: upgrade to 60.6.1-r0
|
Original advisory text
When proxy auto-detection is enabled, if a web server serves a Proxy Auto-Configuration (PAC) file or if a PAC file is loaded locally, this PAC file can specify that requests to the localhost are t...
Security vulnerability affects the firefox-esr package. When proxy auto-detection is enabled, if a web server serves a Proxy Auto-Configuration (PAC) file or if a PAC file is loaded locally, this PAC file can specify that requests to the localhost are to be sent through the proxy to another server.
Internet-facing
14 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically (estimated)
- Gives an attacker partial control (estimated)
Timeline
Published31 Oct 2026
Updated31 Oct 2026
First seen31 Oct 2026
Sources
CLEANSTART-2024-IN60790 · OSV
Track software like this
Free during beta